Vulnerabilities > PHP > PHP > 5.3.10

DATE CVE VULNERABILITY TITLE RISK
2012-07-20 CVE-2012-2688 Buffer Overflow vulnerability in PHP '_php_stream_scandir()'
Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."
network
low complexity
php
critical
 10.0
10
2012-05-24 CVE-2012-1172 Improper Input Validation vulnerability in PHP
The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.
network
php CWE-20
5.8
5.8
2012-05-21 CVE-2012-2376 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in PHP
Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments that trigger incorrect handling of COM object VARIANT types, as exploited in the wild in May 2012.
network
low complexity
php microsoft CWE-119
critical
 10.0
10
2012-05-11 CVE-2012-1823 Improper Input Validation vulnerability in PHP
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
network
low complexity
php CWE-20
7.5
7.5
2012-02-10 CVE-2012-0831 Improper Input Validation vulnerability in PHP
PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c.
network
php CWE-20
6.8
6.8